Domains (T1583.001) is a sub-technique of Acquire Infrastructure in the resource development tactic. The adversary acquires domain names to use in targeting. Domains are the human readable names that map to IP addresses, and they can be bought or, in some cases, obtained for free. Platform: PRE, meaning before the attack reaches you.
How attackers use it
MITRE lists a range of uses, including phishing (T1566), drive-by compromise (T1189) and command and control.
Several naming tricks appear in MITRE's description:
- Similar names. Domains that resemble legitimate ones, through homoglyphs (characters that look alike) or a different top-level domain.
- Typosquatting, used to help deliver payloads through drive-by compromise.
- IDN homograph attacks. Internationalized domain names using other character sets, such as Cyrillic or Greek, create visually similar lookalikes used to deliver malware.
- Generated URLs. Different URLs may be generated dynamically to serve malicious content to each victim, including one-time, single-use domain names.
- Expired domains. Adversaries may acquire and reuse expired domains, which may already be allowlisted or trusted by defenders because of their earlier reputation and history.
On registration data: registrars keep public databases showing contact information for each domain. Private WHOIS services show their own details instead of the owner's, which lets adversaries hide who bought a domain. They may also vary registration details and use different registrars to make tracking harder.
The same idea shows up in software. A package name one letter off from a popular library is a lookalike too, and it targets developers instead of mail readers.
How to detect it
MITRE's detection advice:
- Monitor logged DNS data for purchased domains that could be used in targeting. Reputation or category-based detection may lag, because categorization takes time to update.
- Use services that track newly acquired domains, such as WHOIS databases and passive DNS. In some cases you can pivot on known registration details to find other infrastructure the same adversary bought.
- Monitor for domains created with a similar structure to your own, including under a different TLD.
- Monitor queried DNS registry data.
MITRE notes that tracking across multiple DNS infrastructures can require several tools or more advanced analytics. Detection can also be aimed at the stages that follow, initial access and command and control.
A starter routine: list your own brand names and common misspellings, check variants across the major TLDs on a schedule, and review newly registered matches.
How to reduce the risk
MITRE lists one mitigation: pre-compromise. Organizations may deliberately register similar domains to their own to discourage typosquatting by adversaries. MITRE says other aspects of this technique cannot easily be mitigated with preventive controls.
Beyond that, you can reduce the payoff:
- Treat reputation as a weak signal. An old, previously trusted domain can be repurposed.
- Block newly registered domains at the proxy or DNS layer for categories of users who do not need them, where your tooling allows it.
- Teach people to read the full domain, not just the start of it, and to be careful with look-alike characters.
- For developers, vet new dependencies before adding them.
Check your own environment
- Which lookalike variants of your main domains do you own already?
- Do you receive alerts for new registrations resembling your name?
- Does your proxy or DNS filter score domain age?
- Do developers have a step that checks a package name and publisher before adding it?
Try it yourself
Click through it at your own pace, or open it full screen.
If you want a quick look at your own dependencies, Safeguard offers a free in-browser scan at gold.safeguard.sh/scan. It needs no login, the file never leaves your machine, and it covers up to 100 dependencies.
Quick check
Why can an expired domain be more useful to an adversary than a new one?
It may already be allowlisted or trusted by defenders based on its previous reputation and history.
What is an IDN homograph attack?
Using internationalized domain names with characters from other scripts, such as Cyrillic or Greek, to build domains that look like a legitimate one.
What mitigation does MITRE give?
Registering similar domains yourself to deter typosquatting. Other parts of the technique cannot easily be prevented.
